1. Purpose of This Policy

This policy explains how I collect, store, process, and protect personal and sensitive information shared during counselling. We are committed to maintaining confidentiality, safeguarding client data, and meeting all professional, ethical, and legal obligations under UK GDPR, the Data Protection Act 2018, and the BACP Ethical Framework for the Counselling Professions.

​

2. Scope

This policy applies to all personal and special‑category data processed within the practice, including:

• Contact details

• Session notes and clinical records

• Assessment information

• Communication history

• Appointment and billing information

• Any digital or paper records containing identifiable client information

 

​

​

3. Legal Basis for Processing

I process client data under the following lawful bases:

• Consent – freely given, informed consent for counselling services

• Contract – information required to deliver counselling sessions

• Legitimate interest – maintaining records for professional standards and service continuity

• Legal obligation – where disclosure is required by law (e.g., safeguarding, court orders)

• Vital interests – where information must be shared to prevent serious harm

 

​

​

4. Data Collection

I collect only the information necessary to provide safe, ethical counselling. This may include:

• Name, contact details, emergency contact

• Background information relevant to therapy

• Session notes and assessments

• Email or message correspondence

• Payment records (no card details stored)

 

​

​

5. Confidentiality & Professional Standards

All client information is treated with strict confidentiality in line with:

• BACP Ethical Framework

• Professional supervision requirements

• Safeguarding duties

 

Information is only shared when:

• You provide explicit consent

• There is a risk of serious harm to you or others

• Required by law (e.g., terrorism, drug trafficking, court orders)

• Required to protect a child or vulnerable adult

​

​

6. Data Storage

I use secure, GDPR‑compliant systems to store client data:

• Encrypted digital records

• Password‑protected devices

• Secure cloud storage meeting UK GDPR standards

• Paper notes stored in locked, access‑controlled locations

• Regular encrypted backups

 

Only authorised personnel have access to client information.

​

7. Data Processing

Client data is processed for:

• Delivering counselling sessions

• Maintaining accurate clinical records

• Managing appointments and communication

• Professional supervision (anonymised where possible)

• Service evaluation and quality assurance

 

We do not use client data for marketing or profiling.

​

8. Data Sharing

We do not share client information with third parties unless:

• You provide explicit written consent

• Sharing is necessary for safeguarding or risk management

• Required by law or regulatory authorities

• Required for emergency medical intervention

 

Any third‑party services (e.g., secure email, practice management software) must meet GDPR and ICO compliance standards.

​

9. Data Retention

Client records are retained according to:

• BACP guidance

• ICO recommendations

• Professional insurance requirements

 

Typically, adult counselling records are kept for 7 years after the end of therapy. After the retention period, records are securely destroyed or permanently anonymised.

​

10. Your Rights Under UK GDPR

Clients have the right to:

• Access their personal data

• Request corrections to inaccurate information

• Request deletion (where legally permissible)

• Restrict or object to certain processing

• Receive a copy of their data in a portable format

• Withdraw consent at any time

​

Requests will be responded to within 30 days.

​

11. Data Breach Procedure

If a data breach occurs:

• We will act immediately to contain and assess the incident

• Affected clients will be notified where required

• The ICO will be informed if the breach meets reporting criteria

• Measures will be implemented to prevent recurrence

​

12. Website Cookies & Online Data

If applicable, the website may use cookies for functionality and analytics. Cookie preferences can be managed through your browser settings. No counselling data is collected through website cookies.

​

13. Policy Updates

This policy may be updated to reflect changes in legislation, professional standards, or practice procedures. The most recent version will always be available on our website.

​

14. Contact Information

For questions, concerns, or data requests, please contact:

Data Protection Officer; sheeraz Henderson / Practice Lead: Sheeraz Henderson Email: sheeraz.henderson2@gmail.com]